Skip to content

Add shortened links to install commands #1244

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Conversation

theletterf
Copy link
Contributor

@theletterf theletterf commented May 12, 2025

This adds shortened ela.st script to install commands. It also makes the first curl command silent.

This adds shortened ela.st script to install commands.
@@ -35,7 +35,7 @@ This guide uses the first option. If you'd like to clone the repository and buil
Run this command to download and install the latest version of `docs-builder`:

```sh
sudo curl -L https://raw.githubusercontent.com/elastic/docs-builder/refs/heads/main/install.sh | sh
sudo curl -sL https://ela.st/docs-builder-install | sh
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 If I'm honest, I'm rather concerned about this being a recommendation:

  • generally as a curl | sh
  • then also throwing in sudo here
  • the fact that this is a short URL that could be modified to point to any random location
  • not teaching Elasticians to audit the scripts they're executing with superuser privileges

Looking up this pattern generally results in many articles such as https://lukespademan.com/blog/the-dangers-of-curlbash/ and https://security.stackexchange.com/questions/213401/is-curl-something-sudo-bash-a-reasonably-safe-installation-method and https://macarthur.me/posts/curl-to-bash/

Copy link
Contributor Author

@theletterf theletterf May 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand the concern (and thanks for the suggestion, I've already applied it). It's a popular debate. However:

  • We need a convenient, fast way of installing and updating docs-builder until we've packages set up.
  • We control the ela.st links. Should Elasticians not trust Elastic links? Will the same happens with packages?
  • We're not asking folks to run these instructions for CI/CD.

See https://gnu.moe/wallofshame.md for counterarguments. Even Rust uses this method for local installs.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've removed sudo from the command, as the user will be prompted interactively anyway.

@theletterf
Copy link
Contributor Author

This makes the script a little more robust and makes the sentence about manual downloads more visible. #1255

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants